[PROOFPOINT] Spam Classification Messages ClicksPermitted

alert any $HOME_NET any -> $HOME_NET any (msg:"[PROOFPOINT] Spam Classification Messages ClicksPermitted"; program:proofpoint_siem_api_data; content:"classification
| 22 3a 20 22
| spam"; nocase; content:!"spamScore
| 22 3a 20
| 0"; content:"event_type
| 22 3a 20 22
| clicksPermitted"; reference:url,ptr-docs.proofpoint.com/extensibility-guides/ptr-api/?shell; reference:url,help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API; classtype:trojan-activity; sid:5010921; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_06, updated_at 2023_02_06, mitre_tactic_id TA0001, mitre_technique_id T1566;)